@sema-agent/server 7.121.0 → 7.123.0

package/dist/config-lkg.js

@@ -1,10 +1,9 @@
-import { promises as fs, lstatSync, realpathSync } from "node:fs";
-import { basename, join, dirname, resolve } from "node:path";
+import { promises as fs } from "node:fs";
+import { join, dirname, resolve } from "node:path";
 import { randomBytes } from "node:crypto";
 import { validatePromptsDomain } from "./prompts-domain-validate.js";
 import { centerStateBin, pullTokenIdentity } from "./center-credential.js";
 import { configRootOf } from "./sema-config-dir.js";
-import { recordFailOpen } from "./observability/fail-open.js";
 export function defaultSkillCacheDir(config) {
     return join(configRootOf(config), "skill-cache");
 }
@@ -23,41 +22,10 @@ export function lkgPathOverrideOf(raw) {
 export function lkgReadDenyRows(configLkgPath) {
     if (configLkgPath === undefined)
         return [];
-    return [...new Set([configLkgPath, landedPathOf(configLkgPath)])].map((pattern) => ({ pattern, caseSensitive: false }));
-}
-function landedPathOf(p) {
-    const rest = [];
-    let landed = p;
-    let unresolved;
-    for (let head = p;; head = dirname(head)) {
-        try {
-            landed = join(realpathSync(head), ...rest);
-            break;
-        }
-        catch {
-            if (unresolved === undefined && head !== p && segmentPresent(head))
-                unresolved = head;
-            if (dirname(head) === head)
-                break;
-            rest.unshift(basename(head));
-        }
-    }
-    if (unresolved !== undefined)
-        recordFailOpen("server.config-lkg.landed-path-unresolved", `segment=${unresolved}`);
-    return landed;
-}
-function segmentPresent(p) {
-    try {
-        lstatSync(p);
-        return true;
-    }
-    catch (e) {
-        const code = e.code;
-        return code !== "ENOENT" && code !== "ENOTDIR";
-    }
+    return [{ pattern: configLkgPath, caseSensitive: false }];
 }
 export async function saveLkg(path, worker, identity, effective, etag) {
-    const body = { formatVersion: 2, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
+    const body = { formatVersion: 3, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
     const tmp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
     await fs.mkdir(dirname(path), { recursive: true });
     await fs.writeFile(tmp, JSON.stringify(body), { mode: 0o600 });
@@ -84,14 +52,45 @@ export async function loadLkg(path, worker, identity) {
     const formatVersion = p.formatVersion;
     if (formatVersion === 1)
         return { reason: "pre-identity LKG (formatVersion 1) — not read back: it cannot prove whose credential fetched it (S-651); the next clean candidate rewrites it" };
-    if (formatVersion !== 2)
+    if (formatVersion !== 2 && formatVersion !== 3)
         return { reason: `unknown formatVersion ${String(formatVersion)}` };
     if (typeof p.worker !== "string" || p.worker !== (worker ?? "global"))
         return { reason: `worker mismatch (file=${String(p.worker)})` };
     if (typeof p.identity !== "string" || p.identity !== identity)
         return { reason: "credential identity mismatch (the LKG was fetched under another credential identity — not read back)" };
     const problem = lkgPayloadProblem(p.effective, p.etag);
-    return problem === undefined ? { lkg: p } : { reason: problem };
+    if (problem !== undefined)
+        return { reason: problem };
+    return formatVersion === 2 ? migrateV2Lkg(p) : { lkg: p };
+}
+const RETIRED_CATALOG_COORDINATE = /^models\.(0|[1-9][0-9]*)$/;
+function migrateDroppedIdentityRow(row) {
+    if (row === null || typeof row !== "object")
+        return row;
+    const r = row;
+    const at = typeof r.entry === "string" ? RETIRED_CATALOG_COORDINATE.exec(r.entry) : null;
+    const fields = r.fields;
+    if (at === null || typeof r.name !== "string" || (r.id !== undefined && typeof r.id !== "string") || !Array.isArray(fields) || !fields.every((f) => typeof f === "string") || typeof r.issues !== "string")
+        return row;
+    return { index: Number(at[1]), reasonCode: "entry-schema-invalid", identity: { name: r.name, ...(typeof r.id === "string" ? { id: r.id } : {}) }, fields: [...fields], issues: r.issues };
+}
+function migrateV2Lkg(lkg) {
+    const { etag: _incompleteCarrierValidator, ...envelope } = lkg;
+    const models = lkg.effective.models;
+    const hasRetired = models !== undefined && models !== null && typeof models === "object" && Object.hasOwn(models, "droppedIdentities");
+    let effective = lkg.effective;
+    if (hasRetired) {
+        const { droppedIdentities: retired, ...rest } = models;
+        if (Object.hasOwn(rest, "droppedCatalogEntries")) {
+            return { reason: "both the retired dropped-entry carrier (models.droppedIdentities) and its successor (models.droppedCatalogEntries) are present — no writer produces that shape; not read back" };
+        }
+        effective = { ...lkg.effective, models: { ...rest, droppedCatalogEntries: Array.isArray(retired) ? retired.map(migrateDroppedIdentityRow) : retired } };
+    }
+    return {
+        lkg: { ...envelope, formatVersion: 3, effective },
+        migrated: "formatVersion 2 → 3 (one-time): this LKG was written before every dropped catalog entry was recorded, so its etag is not reused — the next pull re-reads the whole candidate and re-mints the full record" +
+            (hasRetired ? "; the retired carrier models.droppedIdentities was moved to models.droppedCatalogEntries" : ""),
+    };
 }
 function lkgPayloadProblem(effective, etag) {
     if (effective === null || typeof effective !== "object")
@@ -183,7 +182,7 @@ export async function migrateV1Lkg(o) {
         }
     }
     try {
-        await saveLkg(o.binPath, o.worker, o.identity, v1.effective, typeof v1.etag === "string" ? v1.etag : undefined);
+        await saveLkg(o.binPath, o.worker, o.identity, v1.effective, undefined);
     }
     catch (err) {
         return refuse(`writing it into this credential identity's bin failed (${String(err)}) — the old file is left in place and the migration retries on the next LKG read`);

package/dist/config-provider.d.ts

@@ -22,8 +22,9 @@ import type { ConfigProviderWord } from "./config-types.js";
  *  路由进日志/审计流的消费者必须自己先脱敏。 */
 /** `credentialIdentity`(S-651 / [ref] E-15):远程腿恒在场 = 这次拉取所用凭证的身份(分箱键来源);本地腿
  *  缺席(没有凭证 —— config.d 就在本机盘上)。 */
-/** `droppedEntries`(S-704 ②):schema 逐条丢掉的条目(坐标 + 字段诊断,已脱敏)—— **不**进候选门,调用方逐条响亮
- *  点名、其余照用;缺席 = 这次读零逐条丢弃(与 `domainErrors` 同一种缺席即无的形)。 */
+/** `droppedEntries`(S-704 ②):schema 逐条丢掉的条目(坐标 + 字段诊断,已脱敏;S-1295 起每行带闭集词 `reasonCode`)—— **不**进候选门,
+ *  调用方逐条响亮点名、其余照用;缺席 = 这次读零逐条丢弃(与 `domainErrors` 同一种缺席即无的形)。其中的目录条目同一次折叠另记进
+ *  `effective.models.droppedCatalogEntries`(`GET /v1/models.droppedEntries` 的源,与 `models` 同世代)。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
     etag?: string;

package/dist/config-provider.js

@@ -1,6 +1,6 @@
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
-import { splitFoldedReadWarnings, withDroppedIdentities } from "./config-center/read-warnings.js";
+import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./config-center/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, formatConfigPath, REF_CHECKED_DOMAINS, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
@@ -96,7 +96,7 @@ export class LocalConfigProvider {
         const droppedEntries = folded.droppedEntries.map((d) => ({ ...d, error: redactConfigError(d.error) }));
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
         return {
-            effective: withDroppedIdentities(mapToServiceEffective(eff, eff.version), folded.droppedIdentities),
+            effective: withDroppedCatalogEntries(mapToServiceEffective(eff, eff.version), folded.droppedCatalogEntries),
             etag: tag,
             readWarnings,
             ...(errors.length > 0 ? { domainErrors: errors } : {}),

package/dist/config-types.d.ts

@@ -9,6 +9,7 @@ import type { ReadFaceSource } from "./read-face-posture.js";
 import type { PostureSource } from "./posture-source.js";
 import type { SealedCustodyPoison } from "./key-resolver.js";
 import type { ModelEntryRefusal } from "./model-entry-refusal.js";
+import type { DroppedCatalogEntry } from "./config-center/read-warnings.js";
 import type { A2aServerSpec, CompliancePosture, CrossSessionDialogExpiry, CrossSessionInboundSetting, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy, ShellGateDoctrine, WriteProtectedEntry } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
@@ -127,8 +128,8 @@ export declare const DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS = 250;
  * 住在本叶(而不在 `fleet/drain-entry.ts`):`config.ts` 读它,而 drain-entry 值引 `plugins/store-contracts.ts`,config 不值引 plugins 层。
  */
 export declare function fleetScopeOf(raw: string | undefined): string;
-/** 中心基址三席(`SEMA_REGISTRY_URL` / `SEMA_REGISTRY_LIVE_URL` / `SEMA_REGISTRY_WEB_URL`)的形句 —— 判官 `config-center/center-request.ts` `pathBaseUrlFlaw` 一只(公告地址同判),配置目录三行同读这一句。 */
-export declare const CENTER_BASE_URL_RULE = "\u8BBE\u4E86\u5C31\u5FC5\u987B\u662F\u53EF\u89E3\u6790\u7684 http(s) URL,\u4E14\u4E0D\u5E26\u51ED\u636E / query / fragment(\u57FA\u5740\u540E\u9762\u8981\u62FC\u8DEF\u5F84);\u574F\u5F62\u62D2\u542F(\u6CA1\u63A5\u4E2D\u5FC3\u4E5F\u62D2)";
+/** 中心基址三席(`SEMA_REGISTRY_URL` / `SEMA_REGISTRY_LIVE_URL` / `SEMA_REGISTRY_WEB_URL`)与公告地址的形句 —— 判官 `config-center/center-request.ts` `pathBaseUrlRefusal` 一只(形判 = `url-shape.ts`),配置目录四行同读这一句。 */
+export declare const CENTER_BASE_URL_RULE = "\u8BBE\u4E86\u5C31\u5FC5\u987B\u662F\u53EF\u89E3\u6790\u7684 http(s) URL,\u4E14\u4E0D\u5E26\u51ED\u636E / query / fragment(\u57FA\u5740\u540E\u9762\u8981\u62FC\u8DEF\u5F84);\u574F\u5F62\u62D2\u542F(\u6CA1\u63A5\u4E2D\u5FC3\u4E5F\u62D2),\u62D2\u53E5\u53EA\u70B9\u540D\u89C4\u5219,\u4E0D\u56DE\u663E scheme";
 /** 编排器片 2:`FLEET_LEASE_OUTAGE_MAX_MS` 的缺省(24 h)—— 中心 / 库故障、中心降级在今天都靠 LKG 无限期容忍,10 分钟级的窗会把它们变成数据面停服。 */
 export declare const FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS = 86400000;
 /**
@@ -572,6 +573,13 @@ export interface ServiceConfigFlat {
      * 「没这模型」。env 腿恒空;只由 applyEffective 与 `models` **同世代同 commit** 整表重赋值(非粘)。
      */
     modelRefusals: Readonly<Record<string, ModelEntryRefusal>>;
+    /**
+     * S-1295 —— **本世代目录里被读腿逐条丢掉的条目**(载体 `EffectiveConfig.models.droppedCatalogEntries` 经模型面判据判过形的行,保序;
+     * 下标 + settings-schema 闭集词 + 身份 + 字段诊断)。`GET /v1/models` 的 `droppedEntries` 唯一的源(出口投影 `buildDroppedEntriesWire`:
+     * 只投词与可披露身份)。env 腿恒空(没有目录读);只由 applyEffective 与 `models` **同世代同 commit** 整表重赋值(非粘)—— 模型面这一组
+     * 被拒时它与目录一起停在上一代。墓碑(`modelRefusals` 里的 `entry_invalid` 行)是同一份载体的另一种读法,不是第二份记录。
+     */
+    droppedCatalogEntries: readonly DroppedCatalogEntry[];
     /** 配额倍率表(name+id 双键→ModelEntry.quotaWeight):weight-at-burn 的运行时源——tracer 在
      *  brain.call 记账点读它算 weightedTokens(lease 双轴+usage 批报)。registry apply IN-PLACE hot-apply;
      *  env lane 恒空(无倍率概念,weight=1 兜底)。 */
@@ -1479,8 +1487,9 @@ export interface ServiceConfigFlat {
      *  `TaskSpec.enablePlanMode:true` but NOT `handsReadOnly` (writable-start) → core auto-mounts `enter_plan_mode`
      *  (+ `present_plan`) so the model can self-call `enter_plan_mode` at ANY time it judges a task needs planning
      *  (CC EnterPlanMode parity). 🆕 DEFAULT ON (clay: model-driven plan is resident — the model decides when to plan);
-     *  set `PLAN_MODE_ENABLED=false` to opt out. USER-driven plan (`body.permissionMode=plan` → enablePlanMode +
-     *  handsReadOnly, read-only from start) is unaffected/independent. */
+     *  set `PLAN_MODE_ENABLED=false` to opt out. A USER-driven plan (`body.permissionMode=plan`, bundle `defaultMode`, or
+     *  `AUTONOMY=plan`) is the same engine mode word, independent of this knob: the engine's mode table mounts the plan
+     *  tools for a declared `plan` itself, and no plan entry clamps the hands (only `AUTONOMY=read-only` does). */
     planModeEnabled: boolean;
     /**
      * [ref]⑥(core 5.56 `Hooks.timeoutMs` 座)—— **每一只 hook 席位单次调用的时间上限**(ms)。
@@ -2134,10 +2143,12 @@ export interface ServiceConfigFlat {
      *  `loadConfig` **无条件**解析一次:未设 / 空串 ⇒ 缺席(公告环不装);在场必须是可解析的 http(s) URL,否则拒启。读者:fleet 公告环、
      *  围栏判官 `fleetFenceLaneOf`、`/health.center.sessionsVisible`、启动日志 —— 都读这一席,不读 env。 */
     fleetAdvertiseAddress?: string;
-    /** 编排器片 2:服务租约**中心不可达的容忍上限** `T_max`(ms;env `FLEET_LEASE_OUTAGE_MAX_MS`)。租约过期(中心不可达 / 答 unknown)之后照常服务,
-     *  直到过期满这么久 ⇒ 新计费提交 503 `state.lease_expired`(取消 / HITL 应答 / 续跑 / 读面照放行),在飞不动、不自停;中心恢复授予即恢复。
-     *  缺省 86 400 000(24 h);地板 = 服务租约 TTL 地板(settings-schema `SERVING_LEASE_TTL_FLOOR_MS`,60 s);不许 0 / 无穷,坏值拒启。
-     *  只在租约生效时有意义(fleet 成员 ∧ 中心宣告了 `servingLease` 能力位)。 */
+    /** 编排器片 2:一台实例「活着而不服务」的最长时长 `T_max`(ms;env `FLEET_LEASE_OUTAGE_MAX_MS`)。缺省 86 400 000(24 h);地板 = 服务租约
+     *  TTL 地板(settings-schema `SERVING_LEASE_TTL_FLOOR_MS`,60 s);不许 0 / 无穷,坏值拒启。`loadConfig` 无条件解析(成员与非成员同读)。两个读者:
+     *  ① 服务租约**中心不可达的容忍上限**(`fleet/serving-lease.ts`;只在 fleet 成员 ∧ 中心宣告了 `servingLease` 能力位时生效):租约过期(中心
+     *  不可达 / 答 unknown)之后照常服务,直到过期满这么久 ⇒ 新计费提交 503 `state.lease_expired`(取消 / HITL 应答 / 续跑 / 读面照放行),在飞不动、
+     *  不自停;中心恢复授予即恢复。② 排空口 `POST /v1/admin/drain` 的**期限准入上界**(`fleet/drain-entry.ts` 规则 2):`deadlineAt` 离此刻超过它 ⇒
+     *  400 `request.field_invalid`。 */
     fleetLeaseOutageMaxMs: number;
     /** S-698(design-325 §2):中心凭证**续签提前量**(ms)—— `SEMA_REGISTRY_TOKEN_FILE` 指向人的登录会话信封
      *  (`kind:"user-session"`)时,访问令牌离到期 ≤ 本值即由引擎续签并原子改写同一文件(`center-credential-renewer.ts`)。
@@ -2156,7 +2167,7 @@ export interface ServiceConfigFlat {
 /** 组:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
 export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "storeLockWaitMs" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "runStoreStrictHydrate" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "fileHistory" | "fileHistoryCapture" | "sendUserFile">;
 /** 组:modelPlane(模型面)—— 网关坐标、Anthropic 路线、韧性旋钮、主/廉价 model entry、role 表、降级梯。 */
-export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
+export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelRefusals" | "droppedCatalogEntries" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
 export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalGrant" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "autoModeClassifierTimeoutMs" | "crossSessionInbound" | "crossSessionDialogExpiry">;

package/dist/config-types.js

@@ -12,7 +12,7 @@ export const DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS = 250;
 export function fleetScopeOf(raw) {
     return raw ?? GLOBAL_SCOPE;
 }
-export const CENTER_BASE_URL_RULE = "设了就必须是可解析的 http(s) URL,且不带凭据 / query / fragment(基址后面要拼路径);坏形拒启(没接中心也拒)";
+export const CENTER_BASE_URL_RULE = "设了就必须是可解析的 http(s) URL,且不带凭据 / query / fragment(基址后面要拼路径);坏形拒启(没接中心也拒),拒句只点名规则,不回显 scheme";
 export const FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS = 86_400_000;
 export const FIRST_BYTE_TIMEOUT_BOUNDS = { minMs: 0, maxMs: MAX_TIMER_DELAY_MS };
 export const RESILIENCE_DEFAULTS = {

package/dist/config.d.ts

@@ -211,7 +211,7 @@ export declare function buildUnpricedCeilingNotice(models: Record<string, Model>
     fields: Record<string, string>;
 } | undefined;
 /** [ref] N8/N9 — the BOOLEAN member of this module's env-parser family (`env`/`env2`/`numEnv`/
- *  `numEnvBounded`/`optFinitePositiveEnv`/`enumEnv`/`headerNameEnv`/`firstSetEnv`). Until now booleans were the
+ *  `numEnvBounded`/`optFinitePositiveEnv`/`enumEnv`/`headerNameEnv`). Until now booleans were the
  *  one type parsed by a hand-written literal comparison at every single site, and that is exactly why the same
  *  `*_ENABLED` suffix grew FOUR incompatible polarities (opt-in `=== "true"`, opt-out `!== "false"`, the posture
  *  tri-state, and negative `*_DISABLED` names): with no shared helper there was nowhere for the default to be
@@ -298,10 +298,10 @@ export declare function isRosterGateArmed(configCenter: ServiceConfig["configCen
  *   - 够不着挂载工具的协议名:**对端段铸不出**(`mcp__github.com`、`mcp__github.com__*`、`mcp__*`、超长 / 归一后带连串下划线的服务器段、对端段为空的
  *     `mcp__` / `mcp____x`)—— 前缀对,但引擎铸注册名时归一对端段,而规则对对端段逐字比,永不匹配。判官是引擎的 `judgeRuleToolName`(core 7.43.0 #1355 (b)
  *     的判词 `unmintable_segment`,句子带它的 guidance 与 1:1 现名);本仓 7.116.0–7.117.x 那只自比 `mintNamespacePrefix` 的对照随之退役。
- *     引擎判官放行、却一只工具都够不着的一形 —— **工具段为空**(`mcp__srv__`)—— 由本仓判(`namespaced-rule-name.ts`,会话规则写口两腿与 SQL 店写口同调)。
+ *     **工具段为空**(`mcp__srv__`)core 7.48.0 #1400 起也是这一判词(7.116.0–7.122.x 由本仓自答,随之退役)。
  *     ⚠️ 两段覆盖形 `mcp__<server>`(服务器段是自铸形)够得着(S-1047 收掉的分叉,见下)。
- *   - **core 的文法编不出来的串**(名字里带反斜杠、单条 >512 字符、空串):判词取自 core 自己的
- *     `validatePermissionRules`,见 {@link uncompilableRuleGuidance}。[ref]①([ref])补齐 ——
+ *   - **core 的文法编不出来的串**:判词取自 core 自己的 `validatePermissionRules`,射程与指引见 {@link uncompilableRuleGuidance}
+ *     (名表消费者只递得来名字里带反斜杠、单条 >512 字符、空串三种;规则编译器消费者递来的每一条内容形都走这里)。[ref]①([ref])补齐 ——
  *     此前只有 `ask` 腿(经 `createPermissionRulePolicy` 的 throw)拒得出这一族,`deny` 静默 no-op。
  *
  * 已接受的权衡(与退役表墓碑同一条):部署自有工具真叫 `figma__x` 的极端形会被误拒——boot 期无 roster 可
@@ -337,8 +337,8 @@ export interface UnmatchableToolName {
  *    (S-177 / core 7.9.0 起)。引擎**真的按内容匹配** deny / ask 的内容形(`Bash(rm -r:*)` / `Edit(~/.sema/**)`),所以本仓不许再替它拒 ——
  *    判据整条交回 core 的 `validatePermissionRules`,按这张表自己的 behavior 问。core 7.42.0 起策略只说 deny / ask(allow 表不再是本消费者)。
  * (7.117.0 有过第三种 `"allow-layer"` —— 请求的 `settings.permissions.allow` 只判名字。7.118.0 / core 7.43.0 #1358 起引擎的 allow 层自己按名册读条目名并通告
- *  (`permission.allowed_tool_not_granted`,`reason: "tool_name"` / `near_miss`)⇒ 本仓的名字判退役,allow 侧整只交引擎,只剩引擎读不到的那一形在
- *  `task-settings.ts` 经 `rule-entry-list.ts` 拒。)
+ *  (`permission.allowed_tool_not_granted`,`reason: "tool_name"` / `near_miss`)⇒ 本仓的名字判退役,allow 侧整只交引擎;7.116.0–7.122.x 另拒的「工具段为空」
+ *  一形随 core 7.48.0 #1400 也交引擎。)
  */
 export type RuleEntryConsumer = "tool-name-table" | "rule-policy";
 /**
@@ -369,10 +369,10 @@ export declare function unmatchableToolNamesRefusal(source: string, names: reado
  * 7.117.0(core 7.42.0)起这张表整份投 `RunnerDeps.allowedTools`(引擎 allow 层的部署成员,构造时读一次),判据是**引擎的读法**,与请求的两张
  * allow 表同一份(`rule-entry-list.ts`):
  *  ① 值不是字符串表 ⇒ 拒(env 的 CSV 恒给字符串表;判在这里是为了「值一旦换了来源,第一道判仍在」);
- *  ② 引擎读不到的那一形(工具段为空的协议名)⇒ 拒(与技能清单、请求 allow 桶同一只函数);
- *  ③ 引擎读成空的条目(`compileAllowList(names, "allow", 名册 = 空集).inert` 非空 —— `*`、`mcp__*`、写路径 / 域名形、带空白或畸形的名字,以及
- *     core 7.43.0 起条目名过引擎判官读成 `tool_name` 的退役名 / 无前缀短名 / 对端段铸不出)⇒ 拒,句子点名条目、引擎给的原因词(名字层带判词与现名)、
- *     该怎么写。请求的 allow 侧对 ③ 只收通告;运维这一侧拒启:这是运维自己的配置,写错了当场改,而引擎对读成空的部署条目只在每一跑发一条通告。
+ *  ② 引擎读成空的条目(`compileAllowList(names, "allow", 名册 = 空集).inert` 非空 —— `*`、`mcp__*`、写路径 / 域名形、带空白或畸形的名字,以及
+ *     core 7.43.0 起条目名过引擎判官读成 `tool_name` 的退役名 / 无前缀短名 / 对端段铸不出,core 7.48.0 #1400 起含工具段为空的 `mcp__<srv>__`;
+ *     7.116.0–7.122.x 那一形由本仓先拒,随之退役)⇒ 拒,句子点名条目、引擎给的原因词(名字层带判词与现名)、
+ *     该怎么写。请求的 allow 侧对 ② 只收通告;运维这一侧拒启:这是运维自己的配置,写错了当场改,而引擎对读成空的部署条目只在每一跑发一条通告。
  * 文法随引擎:工具名、协议名覆盖形、`Bash(...)` 命令规则、`Read(//dir/**)` 读目录都收(内容形里带逗号的写不进 CSV —— 这张表的分隔符就是逗号)。
  */
 export declare function approvalGrantRefusal(names: unknown): string | undefined;